# Create an exception for the squid server: iptables -t nat -A PREROUTING -p tcp -s 192.168.1.1 --dport 80 -j ACCEPT # Redirect all other LAN requests: iptables -t nat -A PREROUTING -p tcp -s 192.168.1.0/24 --dport 80 -j DNAT --to 192.168.1.1:8080 # Create an exception for root: iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner root --dport 80 -j ACCEPT iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner squid --dport 80 -j REDIRECT --to-port 8080 iptables -I OUTPUT -o eth1 -p tcp -s 127.0.0.1 -d 127.0.0.1 --dport 8080 -j ACCEPTI found a list of free proxy servers at HideMyAss, where I set Sort By: to United States and checked Hide PlanetLab Proxies? Because I wanted to use a squid proxy, I selected only the servers where the Port was 3128. I tested by setting up Firefox on a LAN machine (Windows OS) to proxy the server and found that, although the first server rejected me, the second in the list worked. The server I selected is not all that fast, so I may hunt for something faster, but for now I am OK with this one.
acl jag dstdomain .jag-lovers.orgAdd an external proxy server. It must be a "parent":
cache_peer IP.AD.DR.ESS parent 3128 3130 defaultSpecify the domain you want redirected to the above server:
cache_peer_domain IP.AD.DR.ESS .jag-lovers.orgRepeat the above three entries if you want to use different proxies for other domains. Only one can have the default option. If you just want more domains to use the same external proxy, the acl and cache_peer_domain lines (reputedly but untested) allow more than one domain, so just create a space delimited list of domains on each of those lines (then test)!
Allow requests to destinations not in the above acl to bypass the external proxy:
always_direct deny jagNote that jag in the above line must be an acl.
Finally, force requests to use the remote proxy:
never_direct allow allReload your new squid.conf:
squid -k reconfigure